nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Need help updating SSL Cert for JIRA Software and Service Desk

Majid Mirpour

Hello

I have been tasked with replacing the existing, expired SSL, with a new one, on our JIRA Service Desk and Software server as well as our JIRA Confluence server. I was told by a member of our security team port 443 on the servers is showing that the SSL cert has expired. I am not a JIRA admin at all, I am Linux system admin and I have zero idea of how to go about doing this without breaking the server. The documentation provided by JIRA is confusing for someone with no experience with JIRA at all. Any suggestions on how I can do this?

We are using:

JIRA Service Desk 4.10.1

Jira Software 8.10.1

Jira Core 8.10.1

Atlassian Confluence 6.6.0

Thanks!

Accepted answers

All comments

Brant Schroeder

@Majid Mirpour

Welcome to the community. SSL can be fun because there are so many factors that can determine your success. Do you happen to have a test instance that is setup the same as your production? Is your production instance on a VM?

I would suggest starting with your test instance. If you do not have one then I would suggest taking a snapshot of your VM so you have something to role back to. (DB and Server)

Really though you should review the guide you were talking about. https://confluence.atlassian.com/adminjiraserver0810/running-jira-applications-over-ssl-or-https-1014674543.html

If you are running a proxy or have multiple instances on a single server (Confluence and Jira running on same server), then you could have additional issues.

Since you are on Linux it should be easier since it is similar to adding SSL to any web application running on Linux by ensuring it is in the Java Keystore and properly referenced in jira's configuration.

Majid Mirpour

@Brant Schroeder

Hello Brant!

Thank you for the reply! Yes we do have a staging instance of the server. Jira Service Desk and Jira Software are running as two models on the same server that Jira Core is running on. Confluence is running on a separate server. If i was to follow the instructions in the documentation that you just provided me in your reply, will the existing SSL cert on the server be replaced with the new one? Also are there any tips you can provide me that will help me with this task?

Thanks!

Daniel Ebers

Hi@Majid Mirpour

the setups I came across had a reverse proxy in front of Jira/Confluence - this is a common thing because terminating SSL connection at proxy levels is much easier than at JVM level.

That leads to the question: do you have a Apache or nginx based reverse proxy in front of your Atlassian products?

If so, usually (but without any guarantee for your setup we don't know) renewing a Cert is more of replacing a file, probably reloading the process (Apache or nginx) and you're all set.

Could you please describe your setup any more detailed, do you use a reverse proxy?

Tasked with questions like this I feel documentation is key - as soon this all is sorted out it might be a good idea to document where the configuration must be made so fellow admins of yours can find those information easily.

Cheers,
Daniel

Brant Schroeder

@Majid Mirpour Great news that you have a staging server to test on. Is the test instance a VM that you can take a snapshot of? This will allow for easy rollback if something does not go right.

Yes the documentation would take you through the steps to replace the SSL certificate. As I stated before it would be good to know if you have a proxy setup because that changes things a bit. Do you happen to know if you are running a proxy? You can check the config to see if a proxy is running.

Apache - Look at the server.xml - https://confluence.atlassian.com/kb/proxying-atlassian-server-applications-with-apache-http-server-mod_proxy_http-806032611.html

NGINX - Look at the server.xml - https://confluence.atlassian.com/jirakb/configure-jira-server-to-run-behind-a-nginx-reverse-proxy-426115340.html

As far as tips go I would just make sure that you can recover easily. This way if anything goes wrong you can start over. Even if everything goes well it might be a good idea to do it a couple of times in stage to confirm steps before moving to production.

Majid Mirpour

@Brant Schroeder

@Daniel Ebers

Hello Brant and Daniel

Thank you for the replies. Yes we have an F5 which acts as proxy to our VM thats running Jira. I am checking if we have a separate F5 which acts as the proxy for our Confluence server. I will let you know what I find out. and Yes we can take a snapshot of the JIRA VM. That is not a problem. Our DB for the JIRA server is running on a separate VM. Should I take a snapshot of the DB VM as well?

Thanks!

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira

jira-software

jira-software-server